Welcome back. In this lesson, I'm going to start
with an introduction to sensitive data
exposure problems. Specifically, we're
going to talk about what sensitive data
exposure problems are. Then I'm going to
give an introduction, to some general strategies for preventing sensitive
data exposure. Thinking back to the example I described in the last lesson, the reason why sensitive
data exposure issues come about in applications, is because there tends not to be enough protection for
the particularly sensitive data, that the web application is either transmitting or storing. For example, this would come about when
the web application uses weak cryptography in
order to store sensitive data. For example, like passwords. However, there is a technique
that we're going to talk about when storing
password related data. At the end of this lesson, you'll be able to discuss sensitive data exposure
issues and formulate methods for preventing sensitive data exposure.
Let's dive in. The reason why sensitive
data exposure issues come about in
applications is because, there tends not to be
enough protection for the particularly
sensitive data that the web application is either
transmitting or storing. For example, this
would come about when the web application uses weak cryptography in order
to store sensitive data. However, there is a technique that we're going to talk about when storing password
related information, which we're going to get
into in the later module. The specific issues
that we're going to discuss in Module 4,
are the following. The first issue is, using Personally
Identifiable Information, to basically create
the session ID. The second issue is, when the web application
is not encrypting sensitive information
using standards. Another issue is improperly
storing passwords. The specific technique
that we're going to talk about in the lab, will show you a good way of handling this for your
web applications. The last issue that we're
going to discuss in Module 4, is using HTTP for sensitive
client-server exchanges, instead of the more secure HTTPS. Given the information
that we just discussed, with some of the issues that
come about with some of the sensitive data exposure
problems in web applications. Here are some general strategies for preventing these issues. This is a general strategy list
that comes from OWASP. The first strategy
that you can use, and this is basically the fundamental strategy
that you would want to employ when you're
trying to protect sensitive data usage in
your web application, is to know the types of data that you'll be transmitting
or storing, and what levels of sensitivity
those kinds of data have. Once you know this information, then you know how
to build a security requirements list for
your web application, such that you have a plan, or you can generate a plan
to handle them safely. Which leads us to
the second general strategy, is to basically build into
your software requirements. The security requirements for handling the sensitive data, that you are going to be using
in your web application. Another general strategy
is to pay attention to how the kinds of
data can be cached, and where and know how to disable caching of
your sensitive data. For example, your sensitive data that your web application handles could be
cached at a proxy, or it could be cached
on the browser side. So understanding where
these points are will help you to generate
strategies in order to then go about handling caching of the sensitive data that
you'll be handling. Another general
strategy, is to know how to use cryptography even in a basic sense and
to understand what the minimum current requirements or current standards are. Again, I highly recommend
the book called Cryptography Engineering by
Schneier, Ferguson and Kohno. This is a book that I
mentioned in Module 1. The last general strategy
that you can use is, to not store sensitive data unless you really need to do it. For example, you want
to ask yourself, do I really need to store
this credit card information? Or if you do, are there
standards out there that can help me to handle credit
card information correctly? So for example, a standard way to handle
credit card information. If you need to store it, is to perform
PCI DSS tokenization which I will give you
a link to in a later slide. In summary, we briefly talked about what sensitive data
exposure problems are, and we then talked about some of the general strategies
that you can use in order to prevent sensitive
data exposure issues in your web application. That's all for now.
Thanks for listening.